CVE-2026-46855: Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin)

Synopsis

This is a critical-severity vulnerability in the Metadata Plugin component of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1). A low-privileged attacker with network access over HTTPS can exploit it without any victim interaction, and the scope of impact extends beyond the directly compromised component to other products in the environment. Successful exploitation results in full takeover of Oracle Enterprise Manager Base Platform, including complete loss of confidentiality, integrity, and availability. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched rebuild available the moment Oracle ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Oracle Enterprise Manager Base Platform service over the network via HTTPS; local or physical access is not required.

• AuthenticationRequired

  Any low-privilege account on the platform is sufficient; no administrative or elevated credentials are needed beyond basic authenticated access.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker can exploit this entirely on their own initiative.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout, or other variable environmental factors.

Blast Radius

• A successful attacker reads all data managed by Oracle Enterprise Manager Base Platform, including monitoring credentials, target host metadata, and stored configuration secrets.
• The attacker can modify or delete any persisted configuration, monitoring rules, or managed-target data across the platform.
• The attacker can crash or render the Oracle Enterprise Manager Base Platform service unavailable, disrupting monitoring and management of all connected targets.
• Because the CVSS scope is changed, the attacker gains a foothold capable of pivoting to other products and systems that the Enterprise Manager platform manages or has credentials for.